[litbot-9000]

Why

Go 1.27.3 and 1.26.10 carry the fix for CVE-2026-111943, which distrusts a
set of intermediate certificates in crypto/x509 by SPKI hash. The Go team
tracked it on the urgent track.

pool is the most exposed repo in the set on two counts.

First, auctioneer/client.go:214 dials with credentials.NewTLS(&tls.Config{})
— an empty config, so full public-WebPKI verification against the auctioneer. A
rogue certificate plus network position is a straightforward MITM of the
auction session.

Second, pool was pinned to Go 1.23.6, four release lines behind. Upstream
backported the fix only to 1.26 and 1.27, so there was no patch release to move
to within pool's line — the only way forward was the jump. poolrpc/Dockerfile
was further behind still, on 1.22.3.

The fix blocklists intermediates rather than removing a root, so an OS
trust-store update only helps if the distributor pulls the root. Our binaries
are statically linked and carry their own verifier, so a rebuild on a patched
toolchain is the only way they pick up the new trust decision.

What

Raise the language version in every tracked go.mod — root, auctioneerrpc,
poolrpc, tools — to 1.27.3 and move CI and every Docker image to match.

Pinning the minimum at 1.27.3 is a deliberate call given the severity: it
forces contributors and downstream consumers onto a patched toolchain, not just
our own artifacts.

Verification

Run locally under GOTOOLCHAIN=go1.27.3:

• go build ./... — clean
• go test ./... — unit suite green, 10/10 packages, no failures

Despite spanning four release lines the jump needed no code changes. In
particular nothing here tripped the Go 1.27 encoding/json v2 change, where
json.RawMessage becomes an alias for jsontext.Value and shifts the text of
unmarshal errors — that did bite one golden fixture over in loop.

Pre-existing issue, not introduced here

The poolrpc submodule does not build at all:

perms.go:3:8: no required module provides package gopkg.in/macaroon-bakery.v2/bakery

I confirmed this is pre-existing by reproducing it on untouched master under
GOTOOLCHAIN=go1.23.6. Untouched in this PR; it wants its own fix.

---

Requested by @Roasbeef in the lightninglabs#lnd-bot Keybase channel.
Opened by claudell; a human should review and merge.

Update after the Pool #524 merge

Merged master commit 4bf895e1a431d46ffd4b0f4787576019a8e2ad60 into this branch without rewriting the PR commits. The resulting diff against master remains the 13-file Go 1.27.3/linter-v2 update. The current master btcd-v2 dependency graph and lnd/sqldb replacement are preserved. The tools Dockerfile uses the golangci-lint v2 module path.

Validated locally with Go 1.27.3: make unit, make lint (golangci-lint v2.15.0, 0 issues), go mod verify in the root and all three nested modules, and explicit Go-version checks across module directives, Docker images, CI and linter config. All passed. CI run 39641709217 was pending when this update was written.

CI follow-up

Commit e9ed35692933b6da0c91658aef85984669873e69 adds a narrowly scoped Git safe-directory entry for /build in the tools image. The lint container runs as root against the checkout mounted at /build; without this, Git could not discover VCS metadata and the existing diff processor failed to apply its baseline. No linter or baseline settings changed.

CI run 39646614888 passed all checks: lint (0 issues), unit-race, unit-cover, fuzz, RPC compilation, and Mockgen.

[Roasbeef]

The Go 1.27.3 upgrade preserves the merged btcd-v2 dependency graph and the lnd SQL source pin. The tooling image trusts only its existing /build checkout mount, restoring the unchanged lint baseline without disabling checks. Local Go 1.27.3 unit/lint/module verification and all CI checks pass.